Early-Access List Privacy Notice

Scope and operator

This notice describes how ClinicaVox handles personal information through the public site, early-access list, related operational email, administration console, and any later onboarding or private software-delivery workflow. The locally installed clinical application is a separate environment. Before real-patient use, responsibilities for patient information must be stated in a separate activation agreement and clinic onboarding materials.

Information collected when you join

The early-access form collects first and last name, email, country, province, state or region, city, whether the person is a registered physiotherapist, their reason for interest, baseline questionnaire answers, and consent records. The questionnaire asks about weekly visits, documentation time, after-hours documentation, Home Exercise Program workflow, note confidence, recall, patient follow-up, practice metrics, and confidence regarding governing-college and insurer expectations. The system creates internal and public early-access identifiers. It may also process timestamps, email-delivery status, browser user-agent, Cloudflare security signals, and a one-way hash derived from limited request information for abuse prevention, rate control, auditing, and security.

Baseline questionnaire

The baseline questionnaire is required to submit an early-access request. It supports pilot selection and comparison with later feedback if access is offered. Responses are subjective and do not establish professional, regulatory, insurer, clinical, or legal compliance. Responses belonging to someone who is not selected are deleted with that interest record. Responses from a selected participant are separated from direct identifiers according to the retention schedule below and may then be used for product and pilot analysis.

Purposes of use

Information is used to administer the early-access list, send a requested confirmation, communicate about that interest, identify possible future pilot fit, manage consent, prevent abuse, investigate technical or security issues, and maintain necessary business and legal records. If a person later enters onboarding, additional information may be used under separate notices and agreements to administer onboarding, issue and validate a licence, deliver software, provide support, and evaluate the pilot. Joining does not guarantee selection, access, launch timing, features, pricing, or platform availability.

Prohibited submissions

Do not submit patient names, recordings, clinical notes, diagnoses, health information, health-card or medical-record numbers, login credentials, payment-card data, or confidential information belonging to another person. If prohibited information is received, ClinicaVox may restrict, quarantine, or delete it, or retain only what is reasonably necessary to investigate an incident, comply with law, or protect legal rights.

No patient information in hosted recruitment systems

The public early-access form, email workflow, Cloudflare database, possible onboarding survey, and download portal are not intended to receive patient or clinical information. Routine recordings, transcripts, patient records, and clinical drafting are intended to remain in the locally installed application. A clinic remains responsible for its legal authority, notices, consent, policies, devices, accounts, exports, backups, cloud-synced folders, and use of generated drafts.

Service providers and processing locations

The online workflow uses Cloudflare infrastructure for website delivery, abuse prevention, D1 database storage, private R2 objects, access control, and email routing. Messages sent to ClinicaVox addresses are forwarded to a designated Gmail inbox. These and any future approved service providers may process information in Canada, the United States, or other locations where they or their subprocessors operate, where information may be subject to local law and lawful access. A storage-location hint is not represented as a guarantee that every related service operation remains in that location.

Disclosure and access

Access is limited to people and service providers who reasonably need the information to administer early-access records, review possible fit, evaluate questionnaire responses, manage onboarding and licences, provide support, maintain or secure the service, obtain professional advice, enforce agreements, or comply with law. Information may also be disclosed in connection with a proposed financing, reorganization, sale, or transfer of all or part of the project, subject to appropriate confidentiality and applicable law. ClinicaVox does not sell or rent early-access personal information.

Aggregate and de-identified information

ClinicaVox may create and use statistics that have been aggregated or de-identified so they do not reasonably identify a person, for security, service improvement, capacity planning, pilot evaluation, and business planning. ClinicaVox will not use de-identification as a reason to collect patient information through systems that prohibit it and will not intentionally re-identify properly de-identified information except to test or protect safeguards as permitted by law.

Email communications

An early-access confirmation and messages directly related to the interest requested by the person are operational communications. No message, selection, or access is promised. Product updates, research invitations, and general marketing require a separate optional choice that is unchecked by default and will not be collected until the required sender details and unsubscribe process are published. Marketing consent can be withdrawn.

Later onboarding and software delivery

If a person is later selected and separately agrees to onboarding, the system may record a licence identifier, invitation redemption, and when an installer or licence download starts, completes, or is interrupted. A seven-day invitation may create a two-hour resumable download session. Delivery records are best-effort evidence that the Worker delivered bytes, not proof that software was installed, opened, or used. ClinicaVox does not currently collect installation telemetry.

Retention

Different records are kept for different periods. Each is kept only as long as reasonably necessary for its stated purpose, dispute handling, security, legal compliance, and enforcement of agreements, then deleted or de-identified automatically. The schedule is set out below and is enforced by a daily automated process. Schedule version clinicavox-retention-v1-2026-09-19.

Pilot interest records not converted to participation

6 months after the decisionName, email, location, registration answer, interest statement, and linked baseline answers are deleted. An interest record left open for 12 months is closed automatically so this clock always starts.

Selected participant and licence records

24 months after the participant's pilot access endsKept to administer the pilot and to enforce or defend the activation agreement within the Ontario limitation period.

Baseline questionnaire answers

Separated from the participant at the end of their pilot access, or earlier if the related record is deleted firstThe questionnaire is collected with the early-access request. For a selected participant, answers are moved to a separate de-identified record with no name, email, city, or region, and with completion coarsened to a month. De-identified answers are kept for product and pilot analysis. For a person who is not selected, answers are deleted with the interest record.

Consent evidence

As long as the record it supportsTerms and privacy versions with their timestamps, so the basis for holding a record outlives the record itself.

Marketing consent and withdrawal

3 years after consent is withdrawn or the last message is sentKept to prove consent and to honour an unsubscribe. Withdrawal records exist to protect the person who withdrew.

Email-delivery records

12 months, or 90 days for replies to unsolicited mailMessage type, recipient, template version, delivery status, and any error. Automatic replies to mail sent to the support, privacy, contact, and applications addresses are not tied to an application and are removed on the shorter schedule.

Download invitations

Credentials destroyed 30 days after the link expiresStored invitation and session values are overwritten so an expired link cannot be revived. Invitation and redemption dates stay with the selected participant record.

Download and activity records

Device and network details removed at 90 days; the record is deleted at 12 monthsBrowser user-agent, range header, and the salted request fingerprint are removed first; only the event type and time remain until deletion.

Copies may persist in backups for up to 30 days after deletion. A record may be kept longer when subject to a legal hold, investigation, or other lawful requirement, in which case automated deletion is suspended until the hold is lifted.

Safeguards and security limits

The online workflow is designed to use collection minimization, server-side database access, prepared statements, same-origin checks, Cloudflare Access for administration, spam controls, private object storage, and restricted email aliases. Safeguards reduce risk but cannot guarantee that internet, email, third-party, or endpoint systems are error-free or absolutely secure. ClinicaVox may suspend or restrict access when reasonably necessary to protect people, the service, or others.

Access, correction, withdrawal, and complaints

Subject to applicable law and permitted exceptions, a person may ask about their personal information, request access or correction, withdraw an interest record, or withdraw optional marketing consent by contacting privacy@clinicavox.com. ClinicaVox may require reasonable identity verification and enough detail to locate the record. Withdrawal does not make earlier authorized processing unlawful and may prevent continued contact or onboarding. A concern may also be submitted to the appropriate privacy regulator.

Changes and legal effect

This notice may be updated as ClinicaVox changes. A material new collection, use, disclosure, or consent purpose will be identified in an updated notice and consent version before it is relied on. Nothing in this notice waives rights or obligations that cannot lawfully be waived, creates a guarantee of security or service availability, or replaces a separate activation agreement and software licence if access is later offered.

Contact

Privacy questions, requests, and complaints may be directed to the ClinicaVox Privacy Lead at privacy@clinicavox.com. General questions may be sent to contact@clinicavox.com. These aliases are monitored through the designated administrative inbox. A valid mailing address will be published before optional general marketing is collected or sent.